akashcli 4.6.3__tar.gz → 4.6.4__tar.gz

{akashcli-4.6.3 → akashcli-4.6.4}/PKG-INFO

@@ -1,11 +1,10 @@
 Metadata-Version: 2.4
 Name: akashcli
-Version: 4.6.3
+Version: 4.6.4
 Summary: Akash CLI — secure remote shell relay, file vault, and device management
-License: MIT
+License-Expression: MIT
 Keywords: akash,cli,relay,remote-shell,vault
 Classifier: Programming Language :: Python :: 3
-Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Classifier: Environment :: Console
 Classifier: Topic :: Utilities

akashcli-4.6.4/akashcli/__init__.py

@@ -0,0 +1,7 @@
+try:
+    from importlib.metadata import version
+    __version__ = version("akashcli")
+except Exception:
+    __version__ = "4.6.4"
+
+AKASH_VERSION = __version__

{akashcli-4.6.3 → akashcli-4.6.4}/akashcli/_net.py

@@ -112,6 +112,8 @@ def ws_connect(url: str, **kwargs):
 
     sock_timeout = kwargs.pop("_sock_timeout", 15)
     sock = make_socket(host, port, timeout=sock_timeout)
+    # Remove socket timeout so the WebSocket connection remains open permanently
+    sock.settimeout(None)
 
     # legacy=True: allow calling connect() outside of a `with` block.
     # websockets ≥ 13 requires context manager usage by default;

{akashcli-4.6.3 → akashcli-4.6.4}/akashcli/cli.py

@@ -141,6 +141,13 @@ def _upload_with_progress(client: AkashClient, tmp_path: str, password=None) ->
 # `app`       — primary commands (backup / restore / pull / run / shell …)
 # `cloud_app` — file management (akash cloud upload/files/stream/delete/manage/bulk)
 
+
+def _version_callback(value: bool):
+    if value:
+        from . import __version__
+        print("akashcli v" + __version__)
+        raise typer.Exit(0)
+
 app = typer.Typer(
     invoke_without_command=True,
     rich_markup_mode=None,
@@ -150,6 +157,9 @@ app = typer.Typer(
 
 @app.callback(invoke_without_command=True)
 def _main(ctx: typer.Context,
+          version: bool = typer.Option(False, "--version", "-v", is_eager=True, expose_value=False,
+                                       callback=lambda v: (print("akashcli v1.5.0"), raise_exit()) if v else None,
+                                       help="Show version and exit."),
           help: bool = typer.Option(False, "--help", "-h", is_eager=True, expose_value=False,
                                     callback=lambda v: (_print_help(), raise_exit()) if v else None,
                                     help="Show this message and exit.")):
@@ -256,6 +266,24 @@ def login(
 
 # ── akash whoami ─────────────────────────────────────────────────────────────
 
+
+@app.command()
+def version(url: Optional[str] = typer.Option(None, "--url", help="Server URL to check")):
+    """Show akash CLI version and connected server version."""
+    from . import __version__
+    ver_tag = "v" + __version__
+    print(f"\n  {_C}◈{_RS}  {_W}akashcli{_RS}  {_cy(ver_tag)}")
+    try:
+        _, base = _resolve_client(url, require_key=False)
+        resp = httpx.get(f"{base}/health", timeout=3.0)
+        if resp.status_code == 200:
+            s_ver = resp.json().get("version", "unknown")
+            srv_tag = "(" + s_ver + ")"
+            print(f"  {_DM}server   {_RS}{_cy(base)}  {_dim(srv_tag)}")
+    except Exception:
+        pass
+    print()
+
 @app.command()
 def whoami():
     """Show current account and storage usage."""
@@ -842,41 +870,10 @@ def pull(
             except KeyError:
                 pass
 
-            for member in tar.getmembers():
-                name = member.name
-                if name in ("MANIFEST.json", "manifest_meta.json", "akash.pkgs") or not member.isfile():
-                    continue
-
-                dest = None
-                if name.startswith("home/"):
-                    dest = home / name[len("home/"):]
-                elif name.startswith("abs/"):
-                    dest = Path(name[len("abs"):])
-                elif name.startswith("extra/"):
-                    dest = home / name[len("extra/"):]
-                else:
-                    skipped_list.append(name)
-                    continue
-
-                if dry_run:
-                    restored_list.append(str(dest))
-                    continue
-
-                try:
-                    dest.parent.mkdir(parents=True, exist_ok=True)
-                    file_data = tar.extractfile(member)
-                    if file_data is None:
-                        skipped_list.append(str(dest))
-                        continue
-                    dest.write_bytes(file_data.read())
-                    try:
-                        os.chmod(dest, member.mode)
-                    except OSError:
-                        pass
-                    restored_list.append(str(dest))
-                except (PermissionError, OSError) as e:
-                    skipped_list.append(f"{dest} ({e})")
-
+            from .restore import validate_and_extract_members
+            restored_list, skipped_list = validate_and_extract_members(
+                tar, target_home=home, dry_run=dry_run
+            )
     except Exception as e:
         _err(f"extraction failed: {e}")
         raise typer.Exit(1)
@@ -1250,7 +1247,8 @@ def shell(
 
 @app.command()
 def devices(
-    revoke: Optional[str] = typer.Option(None,  "--revoke", "-r", help="Revoke (unenroll) a device by label"),
+    revoke:    Optional[str] = typer.Option(None,  "--revoke", "-r",    help="Revoke (unenroll) a device by label"),
+    authorize: Optional[str] = typer.Option(None,  "--authorize", "-a", help="Grant server execution access to device"),
     raw:    bool          = typer.Option(False, "--json",          help="Raw JSON output"),
 ):
     """List enrolled devices — or revoke one.
@@ -1292,6 +1290,20 @@ def devices(
 
     _hdrs = {"x-api-key": api_key, "Origin": "https://akash.cli"}
 
+    if authorize:
+        try:
+            import httpx as _hx
+            resp = _hx.post(
+                f"{base}/api/exec/devices/{authorize}/authorize",
+                headers=_hdrs, timeout=10,
+            )
+            resp.raise_for_status()
+            _ok(f"authorized {_ye(authorize)} for server execution")
+        except Exception as e:
+            _err(f"authorize failed: {e}")
+            raise typer.Exit(1)
+        return
+
     if revoke:
         try:
             import httpx as _hx

{akashcli-4.6.3 → akashcli-4.6.4}/akashcli/exec.py

@@ -93,10 +93,21 @@ def _get_machine_key() -> bytes:
     return key
 
 
+def _get_ed25519_key():
+    from cryptography.hazmat.primitives.asymmetric import ed25519 as _ed25519
+    raw = _get_machine_key()
+    return _ed25519.Ed25519PrivateKey.from_private_bytes(raw)
+
+def _get_public_key_b64() -> str:
+    from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
+    pub = _get_ed25519_key().public_key()
+    raw = pub.public_bytes(Encoding.Raw, PublicFormat.Raw)
+    return base64.b64encode(raw).decode("utf-8")
+
 def _sign_challenge(challenge: str) -> str:
-    key = _get_machine_key()
-    sig = _hmac.new(key, challenge.encode(), hashlib.sha256).digest()
-    return base64.b64encode(sig).decode()
+    priv = _get_ed25519_key()
+    sig = priv.sign(challenge.encode("utf-8"))
+    return base64.b64encode(sig).decode("utf-8")
 
 
 def _device_id() -> str:
@@ -235,14 +246,6 @@ def _session_info() -> dict:
 # ── Authentication ────────────────────────────────────────────────────────────
 
 def acquire_exec_token(api_key: str, base_url: str, controller: bool = False) -> str:
-    """
-    Obtain a short-lived exec JWT.
-
-    controller=True  — skip device fingerprint enrollment (used by relay
-                       connect / run / shell).  Just authenticates as owner.
-    controller=False — full challenge/sign/enroll flow (used by akash serve).
-    """
-    # Patch socket DNS for this host — bypasses Android stale DNS cache
     from urllib.parse import urlparse as _up
     _patch_dns(_up(base_url).hostname or "")
 
@@ -251,22 +254,27 @@ def acquire_exec_token(api_key: str, base_url: str, controller: bool = False) ->
         return token
 
     with httpx.Client(base_url=base_url, timeout=10) as client:
-        if controller:
-            # Controller path: no device fingerprint needed — just owner auth.
-            return _auth_key_only(client, api_key, base_url)
-
-        ch = client.post("/api/exec/challenge",
-                         headers={"x-api-key": api_key, "Origin": "https://akash.cli"})
-        if ch.status_code == 404:
-            return _auth_key_only(client, api_key, base_url)
+        ch = client.post(
+            "/api/exec/challenge",
+            headers={"x-api-key": api_key, "Origin": "https://akash.cli"}
+        )
         ch.raise_for_status()
         nonce = ch.json()["nonce"]
 
         sig = _sign_challenge(nonce)
-        ar = client.post("/api/exec/auth",
-                         headers={"x-api-key": api_key, "Origin": "https://akash.cli"},
-                         json={"nonce": nonce, "signature": sig,
-                               "device_id": _device_id(), "label": _device_label()})
+        pub_key = _get_public_key_b64()
+        label = _device_label()
+
+        ar = client.post(
+            "/api/exec/auth",
+            headers={"x-api-key": api_key, "Origin": "https://akash.cli"},
+            json={
+                "nonce": nonce,
+                "signature": sig,
+                "public_key": pub_key,
+                "label": label,
+            }
+        )
         if ar.status_code == 403:
             raise PermissionError(ar.json().get("detail", "Access denied."))
         ar.raise_for_status()

{akashcli-4.6.3 → akashcli-4.6.4}/akashcli/relay.py

@@ -25,6 +25,8 @@ Wire protocol (all JSON frames over the relay WebSocket):
 
 from __future__ import annotations
 
+AKASH_VERSION = "4.6.4"
+
 import base64
 import json
 import os
@@ -36,6 +38,7 @@ from typing import Optional
 
 # ── ANSI (matches cli.py palette) ────────────────────────────────────────────
 _C  = "\033[1;36m"
+_W  = "\033[1;37m"
 _G  = "\033[1;32m"
 _R  = "\033[1;31m"
 _Y  = "\033[1;33m"
@@ -163,14 +166,31 @@ def _run_relay_device(ws, label: str) -> None:
             continue
 
 
+def _clean_display_cmd(cmd_str: str) -> str:
+    """Extracts human-readable command, stripping shell wrapper sentinels."""
+    lines = [
+        line.strip() for line in cmd_str.strip().splitlines()
+        if line.strip() and not line.strip().startswith("cd ") and "__EC__" not in line and "__CWD__" not in line
+    ]
+    if lines:
+        clean = " ".join(lines)
+        return clean if len(clean) <= 60 else clean[:57] + "…"
+    return cmd_str[:50]
+
 def _handle_run(ws, frame: dict) -> None:
-    """Execute a non-interactive command, stream output in real-time, send cwd."""
+    """Execute a non-interactive command, stream output in real-time with live host logging."""
     import subprocess as _sp
     import select as _sel
 
     command  = frame.get("command", "")
-    cwd      = frame.get("cwd", os.path.expanduser("~"))
+    raw_cwd  = frame.get("cwd", "~")
+    cwd      = os.path.expanduser(raw_cwd) if os.path.isdir(os.path.expanduser(raw_cwd)) else os.path.expanduser("~")
     env      = {**os.environ, "TERM": "dumb"}
+    disp_cmd = _clean_display_cmd(command)
+
+    SPIN_FRAMES = ("⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏")
+    spin_idx = 0
+    t0 = time.monotonic()
 
     try:
         proc = _sp.Popen(
@@ -180,9 +200,16 @@ def _handle_run(ws, frame: dict) -> None:
             env=env,
         )
         fd = proc.stdout.fileno()
-        # Non-blocking read: send chunks as soon as they arrive
+
         while True:
-            r, _, _ = _sel.select([fd], [], [], 0.02)
+            r, _, _ = _sel.select([fd], [], [], 0.06)
+
+            # Live host animation
+            f = SPIN_FRAMES[spin_idx % len(SPIN_FRAMES)]
+            spin_idx += 1
+            sys.stdout.write(f"\r  {_C}{f}{_RS}  {_DM}executing:{_RS} {_W}{disp_cmd}{_RS}   ")
+            sys.stdout.flush()
+
             if r:
                 chunk = os.read(fd, 16384)
                 if not chunk:
@@ -192,7 +219,6 @@ def _handle_run(ws, frame: dict) -> None:
                     "data": base64.b64encode(chunk).decode(),
                 }))
             elif proc.poll() is not None:
-                # Drain any remaining bytes
                 try:
                     while True:
                         r2, _, _ = _sel.select([fd], [], [], 0)
@@ -209,20 +235,25 @@ def _handle_run(ws, frame: dict) -> None:
                     pass
                 break
         proc.wait()
-        # Resolve final cwd: try to read it from the shell
-        try:
-            result = _sp.run(
-                ["sh", "-c", f"cd {json.dumps(cwd)} 2>/dev/null; true"],
-                capture_output=True, timeout=1,
-            )
-        except Exception:
-            pass
+
+        elapsed_ms = (time.monotonic() - t0) * 1000
+        ec = proc.returncode or 0
+        sys.stdout.write("\r\033[2K")
+        if ec == 0:
+            print(f"  {_G}✓{_RS}  {_W}{disp_cmd}{_RS}  {_G}[0]{_RS}  {_DM}{elapsed_ms:.1f}ms{_RS}")
+        else:
+            print(f"  {_R}✗{_RS}  {_W}{disp_cmd}{_RS}  {_R}[{ec}]{_RS}  {_DM}{elapsed_ms:.1f}ms{_RS}")
+        sys.stdout.flush()
+
         ws.send(json.dumps({
             "type": "exit",
-            "code": proc.returncode or 0,
+            "code": ec,
             "cwd":  cwd,
         }))
     except Exception as e:
+        sys.stdout.write("\r\033[2K")
+        print(f"  {_R}✗{_RS}  {_W}{disp_cmd}{_RS}  {_R}[error]{_RS}  {_DM}{e}{_RS}")
+        sys.stdout.flush()
         try:
             ws.send(json.dumps({"type": "error", "message": str(e)}))
             ws.send(json.dumps({"type": "exit",  "code": 1, "cwd": cwd}))
@@ -652,10 +683,10 @@ def _guest_code_url(base: str) -> str:
     return f"{base.rstrip('/')}/api/guest/relay/code"
 
 def _guest_host_url(base: str, code: str) -> str:
-    return f"{_ws_base(base)}/api/guest/relay/host?code={code}"
+    return f"{_ws_base(base)}/api/guest/relay/host?code={code}&version={AKASH_VERSION}"
 
 def _guest_join_url(base: str, code: str) -> str:
-    return f"{_ws_base(base)}/api/guest/relay/join?code={code}"
+    return f"{_ws_base(base)}/api/guest/relay/join?code={code}&version={AKASH_VERSION}"
 
 
 def guest_serve(base_url: str) -> None:
@@ -703,7 +734,7 @@ def guest_serve(base_url: str) -> None:
                 # Wait for either a knock (someone wants in) or a ping
                 while True:
                     try:
-                        raw = ws.recv(timeout=35)
+                        raw = ws.recv()
                     except Exception:
                         # Timeout or disconnect — break to reconnect loop
                         break
@@ -983,7 +1014,7 @@ def guest_connect_shell(base_url: str, code: str) -> int:
             print(f"  {_DM}fingerprint  {_C}{fp}{_RS}", flush=True)
         print(f"  {_DM}host has 30 s to respond{_RS}\n", flush=True)
         try:
-            second = json.loads(ws.recv(timeout=35))
+            second = json.loads(ws.recv())
         except Exception:
             ws.close()
             raise RuntimeError("Timed out waiting for host approval.")
@@ -1022,7 +1053,7 @@ def guest_connect_shell(base_url: str, code: str) -> int:
     def _recv_worker():
         while not _stop_recv.is_set():
             try:
-                raw = ws.recv(timeout=1.0)
+                raw = ws.recv()
                 _q_frames.put(raw)
             except Exception as exc:
                 if not _stop_recv.is_set():
@@ -1168,33 +1199,22 @@ def guest_connect_shell(base_url: str, code: str) -> int:
 
     # ── REPL command runner ───────────────────────────────────────────────────
     def _run_cmd(cmd: str) -> tuple:
-        """
-        Send `run` frame, collect stdout in real-time, return (lines, ec, new_cwd).
-        Output is printed live as │ lines while collecting for the footer.
-        """
-        # Wrap: cd to cwd, run command, emit sentinels
-        actual = (
-            f'cd {json.dumps(cwd)} 2>/dev/null\n'
-            f'{cmd}\n'
-            f'printf "\\x00__EC__%d\\x00" "$?"\n'
-            f'printf "\\x00__CWD__%s\\x00" "$PWD"\n'
-        )
+        """Send command cleanly and stream uncorrupted stdout lines in real-time."""
         try:
             ws.send(json.dumps({
                 "type":    "run",
-                "command": actual,
+                "command": cmd,
                 "cwd":     cwd,
             }))
         except Exception:
             return [], 1, cwd
 
-        cols       = _term_cols()
-        buf        = b""
-        lines      : list[str] = []
-        ec         = 0
-        new_cwd    = cwd
-        deadline   = time.time() + 60.0
-        started    = False
+        cols     = _term_cols()
+        buf      = b""
+        lines    : list[str] = []
+        ec       = 0
+        new_cwd  = cwd
+        deadline = time.time() + 60.0
 
         while time.time() < deadline:
             try:
@@ -1209,51 +1229,22 @@ def guest_connect_shell(base_url: str, code: str) -> int:
                 continue
             ft = frame.get("type")
 
-            if ft == "stdout":
+            if ft in ("stdout", "stderr"):
                 chunk = base64.b64decode(frame.get("data", ""))
                 buf  += chunk
-                # Print lines as they arrive — real-time streaming
                 while b"\n" in buf:
                     line_b, buf = buf.split(b"\n", 1)
-                    line = _strip_ansi(line_b.decode("utf-8", errors="replace"))
-                    # Parse null-delimited sentinels
-                    if "\x00__EC__" in line:
-                        import re as _re
-                        m = _re.search(r'\x00__EC__(\d+)\x00', line)
-                        if m:
-                            ec = int(m.group(1))
-                        continue
-                    if "\x00__CWD__" in line:
-                        import re as _re
-                        m = _re.search(r'\x00__CWD__([^\x00]+)\x00', line)
-                        if m:
-                            new_cwd = m.group(1).strip()
-                        continue
-                    if not started:
-                        # Print blank separator before first output line
-                        sys.stdout.write("\n")
-                        started = True
-                    # Print live
-                    display = line.rstrip()
-                    # wrap
-                    wrap = max(cols - 6, 40)
-                    while len(display) > wrap:
-                        sys.stdout.write(f"  {_SH_GR}│{_SH_RS} {display[:wrap]}\n")
-                        display = display[wrap:]
-                    sys.stdout.write(f"  {_SH_GR}│{_SH_RS} {display}\n")
+                    line = _strip_ansi(line_b.decode("utf-8", errors="replace")).rstrip()
+                    sys.stdout.write(f"  {_SH_GR}│{_SH_RS} {line}\n")
                     sys.stdout.flush()
-                    lines.append(line.rstrip())
+                    lines.append(line)
 
             elif ft == "exit":
-                ec      = frame.get("code", ec)
-                new_cwd = frame.get("cwd",  new_cwd) or new_cwd
-                # Flush remaining buffer
+                ec      = frame.get("code", 0)
+                new_cwd = frame.get("cwd", cwd) or cwd
                 if buf:
                     line = _strip_ansi(buf.decode("utf-8", errors="replace")).rstrip()
-                    if line and "\x00__EC__" not in line and "\x00__CWD__" not in line:
-                        if not started:
-                            sys.stdout.write("\n")
-                            started = True
+                    if line:
                         sys.stdout.write(f"  {_SH_GR}│{_SH_RS} {line}\n")
                         sys.stdout.flush()
                         lines.append(line)
@@ -1261,9 +1252,6 @@ def guest_connect_shell(base_url: str, code: str) -> int:
 
             elif ft == "error":
                 msg = frame.get("message", "?")
-                if not started:
-                    sys.stdout.write("\n")
-                    started = True
                 sys.stdout.write(f"  {_SH_GR}│{_RS} {_R}error:{_RS} {msg}\n")
                 sys.stdout.flush()
                 lines.append(f"error: {msg}")
@@ -1271,10 +1259,8 @@ def guest_connect_shell(base_url: str, code: str) -> int:
                 break
 
             elif ft == "ping":
-                try:
-                    ws.send(json.dumps({"type": "pong"}))
-                except Exception:
-                    pass
+                try: ws.send(json.dumps({"type": "pong"}))
+                except Exception: pass
 
         return lines, ec, new_cwd
 
@@ -1368,8 +1354,9 @@ def guest_connect_shell(base_url: str, code: str) -> int:
             sys.stdout.flush()
             _sh_footer(ec, elapsed_ms)
 
-    except Exception:
-        pass
+    except Exception as exc:
+        sys.stderr.write(f"\r\n  [REPL EXCEPTION]: {type(exc).__name__}: {exc}\r\n")
+        sys.stderr.flush()
     finally:
         _stop_recv.set()
         try:

{akashcli-4.6.3 → akashcli-4.6.4}/akashcli/restore.py

@@ -12,7 +12,7 @@ import os
 import tarfile
 import httpx
 from pathlib import Path
-from typing import Optional, Callable
+from typing import Optional, Callable, List, Tuple, Union
 
 
 def _download_archive(client, file_code: str, progress_cb: Optional[Callable] = None) -> bytes:
@@ -41,6 +41,143 @@ def _download_archive(client, file_code: str, progress_cb: Optional[Callable] =
     return b"".join(chunks)
 
 
+
+def _is_safe_subpath(path: Path, base: Path) -> bool:
+    """Verify that path resolves strictly inside base directory."""
+    try:
+        resolved_path = path.resolve()
+        resolved_base = base.resolve()
+        return resolved_path.is_relative_to(resolved_base)
+    except (ValueError, AttributeError):
+        try:
+            return os.path.commonpath([str(path.resolve()), str(base.resolve())]) == str(base.resolve())
+        except ValueError:
+            return False
+
+
+def validate_and_extract_members(
+    tar: tarfile.TarFile,
+    target_home: Optional[Union[str, Path]] = None,
+    dry_run: bool = False,
+    allowed_abs_prefixes: Optional[List[str]] = None,
+) -> Tuple[List[str], List[str]]:
+    """
+    Two-pass secure extractor:
+      Pass 1: Inspect and validate 100% of archive members before writing anything.
+      Pass 2: Safely extract approved files directly into the destination.
+    """
+    home = Path(target_home).expanduser().resolve() if target_home else Path.home().resolve()
+
+    if allowed_abs_prefixes is None:
+        try:
+            from .terminal import _DEFAULT_ABS_PATHS
+            allowed_abs_prefixes = list(_DEFAULT_ABS_PATHS)
+        except Exception:
+            allowed_abs_prefixes = []
+
+    restored: List[str] = []
+    skipped: List[str] = []
+    planned: List[Tuple[tarfile.TarInfo, Path, Path]] = []
+
+    # ── PASS 1: Strict Pre-validation ────────────────────────────────────────
+    for member in tar.getmembers():
+        name = member.name
+
+        # Permitted metadata files
+        if name in ("MANIFEST.json", "manifest_meta.json", "akash.pkgs", "akash.largefiles"):
+            continue
+        if name.startswith("largeref/"):
+            continue
+
+        # Reject unsafe link entries
+        if member.issym() or member.islnk():
+            raise ValueError(f"Unsafe link entry rejected: {name}")
+
+        # Reject traversal or null bytes in member name
+        parts = Path(name).parts
+        if ".." in parts:
+            raise ValueError(f"Path traversal rejected in archive member: {name}")
+        if "\x00" in name:
+            raise ValueError(f"Null byte rejected in archive member: {name}")
+
+        if not member.isfile():
+            continue
+
+        dest: Optional[Path] = None
+        effective_root: Path = home
+
+        if name.startswith("home/"):
+            rel_str = name[len("home/"):].lstrip("/")
+            if not rel_str or ".." in Path(rel_str).parts:
+                raise ValueError(f"Traversal in home member: {name}")
+            dest = home / rel_str
+            effective_root = home
+
+        elif name.startswith("extra/"):
+            rel_str = name[len("extra/"):].lstrip("/")
+            if not rel_str or ".." in Path(rel_str).parts:
+                raise ValueError(f"Traversal in extra member: {name}")
+            dest = home / rel_str
+            effective_root = home
+
+        elif name.startswith("abs/"):
+            rel_str = name[len("abs/"):].lstrip("/")
+            if not rel_str or ".." in Path(rel_str).parts:
+                raise ValueError(f"Traversal in abs member: {name}")
+
+            if target_home:
+                # Sandboxed restore: map abs/ paths safely under target directory
+                dest = home / rel_str
+                effective_root = home
+            else:
+                # Root restore: only permitted if path is in authorized prefix list
+                abs_dest = (Path("/") / rel_str).resolve()
+                matched = None
+                for prefix in allowed_abs_prefixes:
+                    if _is_safe_subpath(abs_dest, Path(prefix)):
+                        matched = prefix
+                        break
+                if matched:
+                    dest = abs_dest
+                    effective_root = Path(matched).resolve()
+                else:
+                    raise ValueError(f"Unexpected absolute path rejected: {name} ({abs_dest} is not authorized)")
+        else:
+            skipped.append(name)
+            continue
+
+        if not _is_safe_subpath(dest, effective_root):
+            raise ValueError(f"Extraction destination {dest} escapes root {effective_root}")
+
+        planned.append((member, dest, effective_root))
+
+    # ── PASS 2: Extraction ───────────────────────────────────────────────────
+    for member, dest, effective_root in planned:
+        if dry_run:
+            restored.append(str(dest))
+            continue
+
+        try:
+            dest.parent.mkdir(parents=True, exist_ok=True)
+            if not _is_safe_subpath(dest.parent, effective_root):
+                raise ValueError(f"Parent directory {dest.parent} escapes authorized root")
+
+            data = tar.extractfile(member)
+            if data is None:
+                skipped.append(str(dest))
+                continue
+            dest.write_bytes(data.read())
+            try:
+                os.chmod(dest, member.mode)
+            except OSError:
+                pass
+            restored.append(str(dest))
+        except (PermissionError, OSError) as e:
+            skipped.append(f"{dest} ({e})")
+
+    return restored, skipped
+
+
 def restore_snapshot(
     client,
     file_code: str,
@@ -112,61 +249,12 @@ def restore_snapshot(
         except KeyError:
             pass  # no large-file manifest in this snapshot
 
-        # ── 3c. Restore each member ───────────────────────────────────────────
-        for member in tar.getmembers():
-            name = member.name
-
-            # Skip metadata-only files
-            if name in ("MANIFEST.json", "manifest_meta.json",
-                        "akash.pkgs", "akash.largefiles"):
-                continue
-            # Skip large-file placeholder prefix (only references, not data)
-            if name.startswith("largeref/"):
-                continue
-
-            if not member.isfile():
-                continue
-
-            # ── Map archive path → real filesystem path ──────────────────────
-            dest: Optional[Path] = None
-
-            if name.startswith("home/"):
-                rel = name[len("home/"):]
-                dest = home / rel
-
-            elif name.startswith("abs/"):
-                # Stored as "abs/absolute/path/to/file"
-                abs_str = name[len("abs"):]   # "/absolute/path/to/file"
-                dest = Path(abs_str)
-
-            elif name.startswith("extra/"):
-                # Extra files land directly in home
-                dest = home / name[len("extra/"):]
-
-            else:
-                skipped.append(name)
-                continue
-
-            if dry_run:
-                restored.append(str(dest))
-                continue
-
-            # ── Write file ───────────────────────────────────────────────────
-            try:
-                dest.parent.mkdir(parents=True, exist_ok=True)
-                data = tar.extractfile(member)
-                if data is None:
-                    skipped.append(str(dest))
-                    continue
-                dest.write_bytes(data.read())
-                # Preserve original permissions where possible
-                try:
-                    os.chmod(dest, member.mode)
-                except OSError:
-                    pass
-                restored.append(str(dest))
-            except (PermissionError, OSError) as e:
-                skipped.append(f"{dest} ({e})")
+        # ── 3c. Restore each member (safe validation & extraction) ───────────
+        r_list, s_list = validate_and_extract_members(
+            tar, target_home=home, dry_run=dry_run
+        )
+        restored.extend(r_list)
+        skipped.extend(s_list)
 
     # ── 4. Reinstall packages from akash.pkgs ────────────────────────────────
     pkg_results = None

{akashcli-4.6.3 → akashcli-4.6.4}/akashcli/terminal.py

@@ -19,7 +19,7 @@ import subprocess
 import tempfile
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import List, Optional, Callable
+from typing import List, Optional, Callable, Tuple
 
 
 # ---------------------------------------------------------------------------
@@ -49,8 +49,6 @@ _DEFAULT_HOME_GLOBS = [
     ".pip/pip.conf", ".config/pip/pip.conf",
     # Misc tools
     ".curlrc", ".wgetrc", ".ripgreprc", ".alacritty.yml",
-    # akashcli own config (so login survives the reset)
-    ".akash",
 ]
 
 # Absolute paths always collected (non-home)
@@ -61,6 +59,120 @@ _DEFAULT_ABS_PATHS: List[str] = []
 # .akashignore loader
 # ---------------------------------------------------------------------------
 
+
+import re
+
+PRIVATE_KEY_BANNERS = (
+    b"-----BEGIN OPENSSH PRIVATE KEY-----",
+    b"-----BEGIN RSA PRIVATE KEY-----",
+    b"-----BEGIN DSA PRIVATE KEY-----",
+    b"-----BEGIN EC PRIVATE KEY-----",
+    b"-----BEGIN PRIVATE KEY-----",
+    b"-----BEGIN ENCRYPTED PRIVATE KEY-----",
+    b"PuTTY-User-Key-File-",
+    b"-----BEGIN PGP PRIVATE KEY BLOCK-----",
+)
+
+EXCLUDED_CREDENTIAL_FILENAMES = {
+    ".git-credentials", ".git-credentials.helper",
+    ".netrc", "_netrc", ".pypirc",
+}
+
+EXCLUDED_CREDENTIAL_DIR_FILES = {
+    ".aws": {"credentials", "config"},
+    ".kube": {"config", "config.json"},
+    ".docker": {"config.json"},
+    ".gh": {"hosts.yml", "config.yml"},
+    ".akash": {
+        "machine.key", "config.enc", "exec_token.json",
+        "exec_session.json", "identity.json", "serve.pid"
+    },
+}
+
+def is_credential_file(fpath: Path, home: Path, include_ssh_private: bool = False) -> Tuple[bool, str]:
+    """Inspect path and content to identify credentials. Never trust extension alone."""
+    name = fpath.name.lower()
+    parts = fpath.parts
+
+    # 1. Akash authentication and machine secrets
+    if ".akash" in parts:
+        if name in EXCLUDED_CREDENTIAL_DIR_FILES[".akash"] or "envs" in parts:
+            return True, "Akash authentication secret or session file"
+
+    # 2. Known credential files
+    if name in EXCLUDED_CREDENTIAL_FILENAMES:
+        return True, "Authentication credentials file"
+
+    for dname, fnames in EXCLUDED_CREDENTIAL_DIR_FILES.items():
+        if dname in parts and name in fnames:
+            return True, f"{dname} configuration/credentials file"
+
+    if ".gnupg" in parts and (name in ("secring.gpg", "trustdb.gpg") or "private-keys-v1.d" in parts):
+        return True, "GPG private key material"
+
+    # 3. Environment secrets (.env, .env.local, .env.production, etc., except examples)
+    if name == ".env" or (name.startswith(".env.") and not name.endswith((".example", ".sample", ".template", ".dist"))):
+        return True, "Environment secrets file"
+
+    # 4. SSH directory checks
+    if ".ssh" in parts:
+        if name not in ("config", "known_hosts", "authorized_keys") and not name.endswith(".pub"):
+            if not include_ssh_private:
+                return True, "SSH private key"
+
+    # 5. Content-level inspection (first 4KB): detect private key signatures regardless of extension
+    try:
+        if fpath.is_file() and fpath.stat().st_size > 0:
+            with open(fpath, "rb") as fh:
+                head = fh.read(4096)
+                for banner in PRIVATE_KEY_BANNERS:
+                    if banner in head:
+                        if include_ssh_private and ".ssh" in parts:
+                            return False, ""
+                        return True, "File content contains private key signature"
+    except (OSError, PermissionError):
+        pass
+
+    return False, ""
+
+
+def redact_url_credentials(text: str) -> str:
+    """Redact passwords embedded in URLs (e.g. postgres://user:pass@host)."""
+    return re.sub(
+        r'(?i)([a-z][a-z0-9+.-]*://)([^:@\s]*):([^@\s]+)@',
+        r'\1\2:[REDACTED]@',
+        text
+    )
+
+def redact_connection_strings(text: str) -> str:
+    """Redact password attributes in database connection strings."""
+    return re.sub(
+        r'(?i)\b(password|passwd|pwd|secret|token|api_?key)\s*=\s*([^;\s\n]+)',
+        r'\1=[REDACTED]',
+        text
+    )
+
+def redact_serialized_secrets(text: str) -> str:
+    pattern = r"""(?i)(["']?(?:password|passwd|pwd|secret|token|api[_-]?key|auth[_-]?token|private[_-]?key|credentials?)["']?\s*[:=]\s*["']?)([^"'\s,;{}]+)(["']?)"""
+    return re.sub(pattern, r"\1[REDACTED]\3", text)
+
+def redact_token_signatures(text: str) -> str:
+    """Redact high-entropy token formats (JWT, AWS keys, tokens)."""
+    text = re.sub(r'\beyJ[A-Za-z0-9-_]+\.eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\b', '[REDACTED_JWT]', text)
+    text = re.sub(r'\bAKIA[0-9A-Z]{16}\b', '[REDACTED_AWS_KEY]', text)
+    text = re.sub(r'\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b', '[REDACTED_TOKEN]', text)
+    text = re.sub(r'\bakash_[A-Za-z0-9_-]{16,}\b', '[REDACTED_API_KEY]', text)
+    return text
+
+def sanitize_secret_text(text: str) -> str:
+    if not text:
+        return text
+    text = redact_url_credentials(text)
+    text = redact_connection_strings(text)
+    text = redact_serialized_secrets(text)
+    text = redact_token_signatures(text)
+    return text
+
 def _load_ignore_patterns(home: Path) -> List[str]:
     """
     Load exclusion patterns from ~/.akashignore (or .akashignore in CWD).
@@ -119,7 +231,23 @@ def _run(cmd: str) -> str:
 
 
 def _collect_metadata() -> dict:
-    """Gather environment metadata stored in the manifest."""
+    """Gather environment metadata with strict redaction of sensitive credentials."""
+    raw_cron = _run("crontab -l 2>/dev/null")
+    sanitized_cron = sanitize_secret_text(raw_cron)
+
+    sensitive_key_needles = (
+        "SECRET", "TOKEN", "PASSWORD", "PASSWD", "PWD", "KEY", "PASS",
+        "HASH", "SALT", "PRIVATE", "CREDENTIAL", "AUTH", "BEARER",
+        "APIKEY", "SIGNATURE", "SESSION"
+    )
+
+    clean_env = {}
+    for k, v in os.environ.items():
+        k_upper = k.upper()
+        if any(s in k_upper for s in sensitive_key_needles):
+            continue
+        clean_env[k] = sanitize_secret_text(v)
+
     return {
         "hostname": platform.node(),
         "system": platform.system(),
@@ -128,15 +256,9 @@ def _collect_metadata() -> dict:
         "shell": os.getenv("SHELL", "unknown"),
         "user": os.getenv("USER") or os.getenv("LOGNAME") or "unknown",
         "snapshot_at": datetime.now(timezone.utc).isoformat(),
-        "crontab": _run("crontab -l 2>/dev/null"),
+        "crontab": sanitized_cron,
         "path_env": os.getenv("PATH", ""),
-        "env_vars": {
-            k: v for k, v in os.environ.items()
-            if not any(s in k.upper() for s in (
-                "SECRET", "TOKEN", "PASSWORD", "KEY", "PASS",
-                "HASH", "SALT", "PRIVATE", "CREDENTIAL"
-            ))
-        },
+        "env_vars": clean_env,
     }
 
 
@@ -260,13 +382,10 @@ def build_snapshot(
                 if _is_ignored_fn(fpath):
                     skipped.append(f"{fpath} (ignored)")
                     continue
-                # Safety: skip private SSH keys unless explicitly requested
-                if not include_ssh_private and fpath.suffix in ("", ".pem", ".ppk"):
-                    if ".ssh" in fpath.parts and fpath.name not in (
-                        "config", "known_hosts", "authorized_keys"
-                    ):
-                        skipped.append(str(fpath))
-                        continue
+                is_cred, reason = is_credential_file(fpath, home, include_ssh_private=include_ssh_private)
+                if is_cred:
+                    skipped.append(f"{fpath} ({reason})")
+                    continue
                 # Large home-dir files (unusual but possible) → treat as ref
                 tier = classify_file(fpath)
                 if tier != FileTier.INLINE:
@@ -314,6 +433,10 @@ def build_snapshot(
 
         # ── 4. Extra paths — inline tier only (Tier B/C handled after tar) ─
         for fpath in extra_inline:
+            is_cred, reason = is_credential_file(fpath, home, include_ssh_private=include_ssh_private)
+            if is_cred:
+                skipped.append(f"{fpath} ({reason})")
+                continue
             arc_path = f"extra/{fpath.name}"
             try:
                 tar.add(str(fpath), arcname=arc_path)
@@ -392,8 +515,13 @@ def build_snapshot(
         manifest["security"] = detect_tier(final_bytes)
     else:
         final_bytes = raw_bytes
-        manifest["security"] = {"tier": 0, "tier_label": "Public (no encryption)",
-                                 "encrypted": False, "requires_password": False,
-                                 "device_locked": False}
+        manifest["security"] = {
+            "tier": 0,
+            "tier_label": "Unencrypted (Public)",
+            "encrypted": False,
+            "requires_password": False,
+            "device_locked": False,
+            "warning": "Snapshot is unencrypted and public. Protect sensitive backups using --password or --device-lock."
+        }
 
     return final_bytes, manifest, archive_name

{akashcli-4.6.3 → akashcli-4.6.4}/akashcli/uploader.py

@@ -34,6 +34,42 @@ class VaultUploader:
         if password:
             headers["x-vault-password"] = password
 
+        # 0. Distributed Upload Worker Integration: Attempt direct worker ticket ingestion
+        if content is None and file_path and os.path.exists(file_path):
+            try:
+                ticket_url = f"{self.client.base_url}/api/upload/ticket"
+                t_resp = httpx.post(
+                    ticket_url,
+                    headers=self.client._get_headers(headers),
+                    timeout=10.0
+                )
+                if t_resp.status_code == 200:
+                    t_data = t_resp.json()
+                    ingest_url = t_data.get("ingest_url")
+                    ticket_jwt = t_data.get("ticket")
+                    file_code = t_data.get("file_code")
+                    if ingest_url and ticket_jwt:
+                        file_size = os.path.getsize(file_path)
+                        with open(file_path, "rb") as fh:
+                            w_files = {"file": (os.path.basename(file_path), fh)}
+                            w_headers = {"x-upload-ticket": ticket_jwt}
+                            w_resp = httpx.post(ingest_url, files=w_files, headers=w_headers, timeout=None)
+                            if w_resp.status_code == 200:
+                                d = w_resp.json()
+                                res = UploadResult(
+                                    status=d.get("status", "processing"),
+                                    file_code=file_code,
+                                    embed_url=f"{self.client.base_url}/embed/{file_code}",
+                                    direct_url=f"{self.client.base_url}/download/{file_code}",
+                                    input_type="file",
+                                    dna=d.get("dna", {})
+                                )
+                                if res.status == "processing":
+                                    res = self._poll_until_done(res)
+                                return res
+            except Exception:
+                pass  # Fall back to standard monolithic upload
+
         url = f"{self.client.base_url}/api/upload"
         
         try:

{akashcli-4.6.3 → akashcli-4.6.4}/akashcli.egg-info/PKG-INFO

@@ -1,11 +1,10 @@
 Metadata-Version: 2.4
 Name: akashcli
-Version: 4.6.3
+Version: 4.6.4
 Summary: Akash CLI — secure remote shell relay, file vault, and device management
-License: MIT
+License-Expression: MIT
 Keywords: akash,cli,relay,remote-shell,vault
 Classifier: Programming Language :: Python :: 3
-Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Classifier: Environment :: Console
 Classifier: Topic :: Utilities

{akashcli-4.6.3 → akashcli-4.6.4}/pyproject.toml

@@ -1,14 +1,13 @@
 [project]
 name = "akashcli"
-version = "4.6.3"
+version = "4.6.4"
 description = "Akash CLI — secure remote shell relay, file vault, and device management"
 readme = "README.md"
 requires-python = ">=3.9"
-license = { text = "MIT" }
+license = "MIT"
 keywords = ["akash", "cli", "relay", "remote-shell", "vault"]
 classifiers = [
     "Programming Language :: Python :: 3",
-    "License :: OSI Approved :: MIT License",
     "Operating System :: OS Independent",
     "Environment :: Console",
     "Topic :: Utilities",
@@ -28,3 +27,8 @@ akash = "akashcli.cli:app"
 [build-system]
 requires = ["setuptools", "wheel"]
 build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["akashcli*"]
+exclude = ["patches*", "dist*", "tests*"]

akashcli-4.6.3/akashcli/__init__.py

@@ -1,6 +0,0 @@
-# akashcli/__init__.py
-from .client import AkashClient
-from .models import UploadResult, FileInfo, UserInfo
-from .exceptions import AkashError
-
-__version__ = "2.0.0"